Which level will I have?
Your assurance level does not come from being an essential or important entity, but from the risk score you calculate with the DNSC tool. Choose your sectors and size; we show the score with the standard values and what the level means, in controls, targets and evidence.
Choose at least one sector to see the score.
Banks and financial market infrastructures under DORA do not do the risk level assessment: they apply the DORA measures, and of OUG 155/2024 only registration remains (DNSC Order 1/2026, art. V).
Estimated score
points
the highest among the chosen sectors
By sector
Banking is left out of the calculation: under DORA there is no ENIRE.
For postal and courier services, the ENIRE@RO v2 tool gives 45 / 90 / 135 points, while the table published in Order 2/2025 gives 50 / 100 / 150. At medium size the difference changes the level (Basic or Important); check in the official tool.
What the level means
- Controls
- Self-assessment targets
- Not-applicable requirements
If you are an essential entity (not just at the Essential level), the remediation plan goes to DNSC within 30 days of the self-assessment, owned by management (art. 12 (5)).
What comes next
You calculate the official score on the NIS2@RO platform or in the ENIRE@RO tool, sign it and send it to DNSC within 60 days of the registration decision; DNSC validates it within 15 days. Then you have 60 days for the self-assessment at the resulting level.
How it is actually calculated
For each sector, the DNSC tool takes five attack categories (sabotage, espionage, cybercrime, hacktivism, attacks on reputation) and five types of attackers (competitors, activists, terrorists, criminals, state actors). For each pair it multiplies impact (0, 5 or 10) by probability (0, 0.5 or 1), by the nature of the attack (1 global, 2 targeted) and by company size (1 small, 2 medium, 3 large), then adds everything up. The result falls into one of three bands.
Impact and probability have standard values per sector; you can change them only with a justification you send to DNSC with the report, and DNSC may reject it: the level can go up, not down. The nature of the attack cannot be changed. The score is recalculated every three years or when the impact of your services grows.
The values here are recalculated from the ENIRE@RO v2 tool of 2 February 2026 and are re-checked at every new version published by DNSC.
Indicative estimate, with the standard values of the DNSC tool. The official score is the one validated by DNSC on NIS2@RO. This is not legal advice.